# CVE-2022-4696: linux: There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation

CVE-2022-4696 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-4696, released January 11, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2022-4696
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0044
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jan 11, 2023

## Description

There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 5.14.6-1 | [DEBIAN-CVE-2022-4696](https://patchblox.com/security/data/fix/linux/debian-cve-2022-4696.md) | Jan 11, 2023 |
| Linux | linux Debian 13.5 (trixie) | 5.14.6-1 | [DEBIAN-CVE-2022-4696](https://patchblox.com/security/data/fix/linux/debian-cve-2022-4696.md) | Jan 11, 2023 |
| Linux | linux Debian 14 | 5.14.6-1 | [DEBIAN-CVE-2022-4696](https://patchblox.com/security/data/fix/linux/debian-cve-2022-4696.md) | Jan 11, 2023 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.